CVE-2022-39211CWE-918

Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server

Low · published September 16, 2022

CVSS v3.1
3.0
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00961 · 61.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2022-09-16T23:10Z
EPSS history
Timeline
  • 16 SEP 23:10Z
    Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
    cvelistv5